registry

type Credential string

type Env struct {
	API      *api.Client // nil when no credential is configured; APIErr says why
	APIErr   error
	Local    *local.Runner // nil when no tailscale CLI was found; LocalErr says why
	LocalErr error
	Config   *config.Loaded
	// Privacy names masked values and keys audit-log digests (spec §7.6); nil
	// when no key was provided, and PrivacyErr then says why if one was malformed.
	Privacy    *privacy.Key
	PrivacyErr error
	Now        func() time.Time
}

type Meta struct {
	Name       string
	Area       string // CLI group, e.g. "devices"
	Verb       string // CLI command, e.g. "list"
	Summary    string
	Tier       Tier
	Stage      Stage
	PlanGate   string // documented plan gating; "" means all plans
	Credential Credential
	Scopes     []string // minimal OAuth scopes, companions included
	// PartialScopes means each scope reads part of the result (settings fields,
	// key types): a missing one narrows the result instead of failing the tool.
	PartialScopes bool
	Notes         string // extra facts for the docs, e.g. an unverified scope
	// Operations are the API operations the tool calls, as "METHOD /path" with the
	// path spelled as Tailscale's OpenAPI document spells it (spec §20).
	Operations []string
	// MaxResultChars raises the result size an MCP host keeps for this tool
	// (Claude Code's anthropic/maxResultSizeChars); 0 leaves the default, which
	// list tools raise to 200,000 characters.
	MaxResultChars int
}

type Registry struct {
	// contains filtered or unexported fields
}

type Stage string

type Tier string

type Tool struct {
	Meta            Meta
	InputType       reflect.Type
	OutputType      reflect.Type
	InputSchema     *jsonschema.Schema
	OutputSchema    *jsonschema.Schema
	UntrustedFields []string // JSON paths of untrusted output fields
	PersonalFields  []string // JSON paths of identifiers masked whole unless personalData is "show"
	PlainFields     []string // JSON paths of untrusted fields kept unmasked (configuration such as routes)
	EmailFields     []string // JSON paths of untrusted fields whose email addresses alone are masked
	// contains filtered or unexported fields
}